Master this deck with 21 terms through effective study methods.
Generated from uploaded pdf
The primary function of the Domain Name System (DNS) is to map logical domain names to IP addresses, allowing users to access websites using human-readable names instead of numerical IP addresses.
DNS communication occurs using two main protocols: UDP for common queries and answers on port 53, and TCP for long answers and zone transfers, facilitating data exchange between resolvers and name servers.
Resource Records (RRs) are the fundamental data entries in the DNS database, consisting of a domain name, record type, variable-length data, and a Time to Live (TTL) value that specifies how long the record can be cached by clients.
The Time to Live (TTL) in DNS records specifies the duration for which clients may cache the record. It typically ranges from a few hours to several days, affecting how quickly changes propagate across the Internet.
The most common types of Resource Records in DNS include A (Address), AAAA (IPv6 Address), CNAME (Canonical Name), MX (Mail Exchange), and NS (Name Server) records, each serving different purposes in domain resolution.
In a Zone Configuration File, the '@' symbol denotes the implicit domain, and if a domain name is omitted on the left side, it inherits the domain from the last line. Domain names without a trailing dot are treated as relative and are suffixed accordingly.
Domain names in the DNS hierarchy are structured as a tree, where each node is identified by a domain name. The root domain is denoted as '.', and a domain name is a concatenation of the node name and all parent node names, delimited by '.'
Top-level domains (TLDs) are the highest level in the domain name hierarchy, including generic TLDs such as .com, .org, .edu, .gov, .mil, and .net, which categorize domains based on their purpose or organization type.
DNSSEC (Domain Name System Security Extensions) enhances DNS security by adding digital signatures to DNS records. Key records include RRSIG (Signature), DS (Delegation Signer), NSEC (Next Secure), and DNSKEY (Key) for verifying data integrity.
SRV records provide information about services available for a domain, including service name, protocol, priority, weight, and port number, while MX records specifically indicate mail exchange servers for email delivery.
When a Name Server (NS) is queried for a domain it does not manage, it can either reject the query, resolve the request recursively and provide a non-authoritative answer, or forward the query to another NS.
Primary name servers store zone records permanently in their configuration files, while secondary name servers periodically check for updates and perform zone transfers to ensure they have the most current version of zone data.
Managing version numbers in DNS zone files is crucial because secondary name servers rely on these numbers to determine if they need to update their records. Failing to increment the version number after changes can lead to outdated data.
The maximum length of a domain name is 255 characters, with individual node names limited to 63 characters. For domains with email addresses, the maximum length is 253 characters.
DNS is case insensitive, meaning that domain names can be entered in any combination of upper and lower case letters without affecting the resolution process.
While the use of national character sets in domain names is possible, it is not recommended due to potential compatibility issues and the complexity it introduces in DNS resolution.
NSEC records provide proof of non-existence for DNS entries, preventing the faking of nonexistent records, while NSEC3 enhances security by preventing zone walking, making it harder for attackers to enumerate domain names.
The TLSA record is used to associate a domain name with a specific certificate or public key, enhancing security for services like HTTPS by allowing clients to verify the authenticity of the server's certificate.
When resolving a query for a domain name, the DNS follows a hierarchical process starting from the root name servers, querying authoritative servers for each level of the domain until it retrieves the final IP address.
DNS propagation delays can lead to inconsistencies in domain resolution, as changes to DNS records may take several hours or days to be reflected across all DNS servers, potentially causing accessibility issues.
An authoritative answer comes directly from a DNS server that holds the original zone data, while a non-authoritative answer is provided by a server that has cached the information from another source, lacking direct authority over the data.